From 9fcd9d7ab5e3b5c4838e42eff377061cdca9a160 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 23 Aug 2026 22:34:31 +1000 Subject: [PATCH] Grant agents AppRole read on the Authentik provider token (#137) A one-off `terragrunt import` in terraform-authentik is needed to reconcile the Authentik resources orphaned by the jellyfin apply failure. The agents AppRole must be able to read the Authentik provider token (`kv/service/terraform/authentik`) to run the import; this grant is read-only on that single path and can be reverted once the import is done. - Add `kv/service/terraform/authentik/read` policy (read on `kv/data/service/terraform/authentik`) bound to the `agents` AppRole Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/137 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- policies/kv/service/terraform/authentik/read.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 policies/kv/service/terraform/authentik/read.yaml diff --git a/policies/kv/service/terraform/authentik/read.yaml b/policies/kv/service/terraform/authentik/read.yaml new file mode 100644 index 0000000..655de85 --- /dev/null +++ b/policies/kv/service/terraform/authentik/read.yaml @@ -0,0 +1,14 @@ +# Lets the agents AppRole read the Authentik provider API token so a coding +# agent can run a one-off `terragrunt import` in terraform-authentik to +# reconcile resources orphaned by the failed jellyfin apply. Read-only on the +# single token path; revert once the import is done. Mirrors the +# gitea/creds/unkin-agent binding pattern. +--- +rules: + - path: "kv/data/service/terraform/authentik" + capabilities: + - read + +auth: + approle: + - agents